GET /cases/{caseId}
PATCH /cases/{caseId}

POST /cases/batch-get
POST /cases/bulk-assign
GET  /cases/search?status=OPEN&region=WEST
POST /reports/enforcement-backlog
POST /exports/cases.csv
POST /jobs/recalculate-risk

An endpoint that touches N objects requires authorization semantics for N objects.

1. Every returned object must be individually authorized or produced from an authorized query scope.
2. Every mutated object must be individually authorized for the specific action.
3. Authorization must happen before pagination, counting, aggregation, export, and side effects.
4. Field-level authorization must be applied to every returned/exported object.
5. Async execution must not rely only on the caller's current UI state.
6. Audit must record both the operation-level decision and the object-level result set or an auditable digest.
7. Partial success semantics must be explicit.
8. Unauthorized object existence must not be leaked unless the domain intentionally allows it.

Do not authorize the endpoint. Authorize the dataset and the operation.

This is just a list endpoint.
This is just an admin report.
This is just a helper endpoint.
This is just export.

May this subject use the bulk assignment feature at all?

May this subject assign this specific case to this specific user?

Operation-level authorization never substitutes object-level authorization.

{
  "caseIds": ["CASE-100", "CASE-101", "CASE-102"],
  "include": ["summary", "assignee", "risk"]
}

@PostMapping("/cases/batch-get")
public List<CaseDto> batchGet(@RequestBody BatchGetCasesRequest request) {
    return caseRepository.findAllById(request.caseIds()).stream()
            .map(caseMapper::toDto)
            .toList();
}

public List<CaseSummaryDto> batchGet(BatchGetCasesCommand command, Subject subject) {
    CaseReadScope scope = scopeFactory.caseReadScope(subject);

    List<CaseRecord> records = caseRepository.findVisibleByIds(
            scope,
            command.caseIds()
    );

    return records.stream()
            .map(record -> caseFieldPolicy.shapeForRead(subject, record))
            .toList();
}

public interface CaseRepository {
    List<CaseRecord> findVisibleByIds(CaseReadScope scope, Collection<CaseId> ids);
}

select c.*
from cases c
where c.id = any(:ids)
  and c.tenant_id = :tenant_id
  and (
       c.assigned_user_id = :subject_id
       or c.owning_unit_id = any(:visible_units)
       or exists (
           select 1
           from case_watchers w
           where w.case_id = c.id
             and w.user_id = :subject_id
       )
  )

Unauthorized objects are not loaded into application memory.

public BatchReadResult<CaseSummaryDto> batchGet(BatchGetCasesCommand command, Subject subject) {
    List<CaseRecord> candidates = caseRepository.findAllInTenantByIds(
            subject.tenantId(),
            command.caseIds()
    );

    Map<CaseId, CaseRecord> byId = candidates.stream()
            .collect(Collectors.toMap(CaseRecord::id, Function.identity()));

    List<BatchItemResult<CaseSummaryDto>> results = new ArrayList<>();

    for (CaseId requestedId : command.caseIds()) {
        CaseRecord record = byId.get(requestedId);

        if (record == null) {
            results.add(BatchItemResult.notFoundOrDenied(requestedId));
            continue;
        }

        AuthorizationDecision decision = authorizationService.decide(
                AuthorizationRequest.builder()
                        .subject(subject)
                        .action("case.read")
                        .resource(ResourceRef.of("case", record.id().value()))
                        .attribute("case.status", record.status().name())
                        .attribute("case.classification", record.classification().name())
                        .attribute("case.assignedUserId", record.assignedUserId().value())
                        .build()
        );

        if (!decision.allowed()) {
            results.add(BatchItemResult.notFoundOrDenied(requestedId));
            continue;
        }

        CaseSummaryDto dto = caseFieldPolicy.shapeForRead(subject, record);
        results.add(BatchItemResult.allowed(requestedId, dto));
    }

    return BatchReadResult.of(results);
}

{
  "results": [
    { "id": "CASE-100", "status": "OK", "value": { "title": "..." } },
    { "id": "CASE-101", "status": "NOT_FOUND" }
  ]
}

{
  "results": [
    { "id": "CASE-100", "status": "OK", "value": { "title": "..." } },
    { "id": "CASE-101", "status": "DENIED", "reasonCode": "CASE_NOT_IN_VISIBLE_SCOPE" }
  ]
}

{
  "missing": ["CASE-999"],
  "denied": ["CASE-101"]
}

External API: denied and missing collapse into NOT_FOUND.
Internal workflow API: denied may be explicit when the caller is allowed to know the object exists.

POST /cases/bulk-assign

{
  "caseIds": ["CASE-100", "CASE-101", "CASE-102"],
  "assigneeId": "user-77",
  "reason": "Workload rebalancing"
}

May this subject bulk assign cases?

May this subject use bulk assignment?
May this subject assign CASE-100?
May this subject assign CASE-101?
May this subject assign CASE-102?
May this subject assign to user-77?
May this subject assign these cases in their current lifecycle state?
May this subject assign cases of this classification?
May this subject perform this action without violating separation of duties?

@Transactional
public BulkAssignResult assignAllOrNothing(BulkAssignCommand command, Subject subject) {
    requireOperation(subject, "case.bulk_assign");

    List<CaseRecord> cases = caseRepository.findForUpdateByIdsInTenant(
            subject.tenantId(),
            command.caseIds()
    );

    if (cases.size() != command.caseIds().size()) {
        throw new AccessDeniedOrNotFoundException();
    }

    List<AuthorizationDecision> decisions = cases.stream()
            .map(caseRecord -> canAssign(subject, caseRecord, command.assigneeId()))
            .toList();

    Optional<AuthorizationDecision> denied = decisions.stream()
            .filter(AuthorizationDecision::denied)
            .findFirst();

    if (denied.isPresent()) {
        audit.deniedBulkOperation(subject, command, denied.get());
        throw new AccessDeniedException("Bulk assign denied");
    }

    for (CaseRecord caseRecord : cases) {
        caseRecord.assignTo(command.assigneeId(), command.reason(), subject.id());
        caseRepository.save(caseRecord);
    }

    audit.allowedBulkOperation(subject, command, cases);
    return BulkAssignResult.success(cases.size());
}

@Transactional
public BulkAssignResult assignPartial(BulkAssignCommand command, Subject subject) {
    requireOperation(subject, "case.bulk_assign");

    List<CaseRecord> candidates = caseRepository.findForUpdateByIdsInTenant(
            subject.tenantId(),
            command.caseIds()
    );

    Map<CaseId, CaseRecord> byId = candidates.stream()
            .collect(Collectors.toMap(CaseRecord::id, Function.identity()));

    List<BulkItemResult> results = new ArrayList<>();

    for (CaseId id : command.caseIds()) {
        CaseRecord caseRecord = byId.get(id);

        if (caseRecord == null) {
            results.add(BulkItemResult.notFoundOrDenied(id));
            continue;
        }

        AuthorizationDecision decision = canAssign(subject, caseRecord, command.assigneeId());

        if (!decision.allowed()) {
            results.add(BulkItemResult.denied(id, decision.safeReasonCode()));
            continue;
        }

        caseRecord.assignTo(command.assigneeId(), command.reason(), subject.id());
        caseRepository.save(caseRecord);
        results.add(BulkItemResult.changed(id));
    }

    audit.bulkItemResults(subject, command, results);
    return BulkAssignResult.partial(results);
}

{ "success": true }

{
  "mode": "PARTIAL_SUCCESS",
  "changed": 2,
  "failed": 1,
  "items": [
    { "id": "CASE-100", "status": "CHANGED" },
    { "id": "CASE-101", "status": "DENIED", "reasonCode": "CASE_OUTSIDE_JURISDICTION" },
    { "id": "CASE-102", "status": "CHANGED" }
  ]
}

previewId
subjectId
tenantId
action
resourceIds
policyVersion
resourceVersionVector
expiresAt
nonce

Preview explains likely result. Apply is authoritative.

GET /cases?status=OPEN&sort=createdAt&limit=50&offset=0

List<CaseRecord> records = caseRepository.search(filter, page);
return records.stream()
        .filter(record -> authorizationService.canRead(subject, record))
        .map(mapper::toDto)
        .toList();

Authorization scope must be part of the query before pagination, sorting, count, aggregation, and response shaping.

public Page<CaseSummaryDto> searchCases(CaseSearchQuery query, Subject subject) {
    validateAllowedFilterFields(query, subject);
    validateAllowedSortFields(query, subject);

    CaseReadScope scope = scopeFactory.caseReadScope(subject);

    Page<CaseRecord> page = caseRepository.searchVisibleCases(
            scope,
            query.filter(),
            query.pageRequest()
    );

    List<CaseSummaryDto> shaped = page.items().stream()
            .map(record -> caseFieldPolicy.shapeForList(subject, record))
            .toList();

    return page.mapItems(shaped);
}

Page<CaseRecord> searchVisibleCases(
        CaseReadScope scope,
        CaseSearchFilter filter,
        PageRequest pageRequest
);

GET /cases?whistleblowerId=USER-123

public void validateAllowedFilterFields(CaseSearchQuery query, Subject subject) {
    for (String field : query.filter().fields()) {
        if (!fieldPolicy.canFilterBy(subject, "case", field)) {
            throw new AccessDeniedException("Filter field not allowed");
        }
    }
}

GET /cases?sort=riskScore

If a subject cannot know a field, they usually cannot sort or filter by it.

{
  "total": 317,
  "items": []
}

May this subject export this dataset?
May this subject export these fields?
May this subject export this many rows?
May this subject export this format?
May this subject export outside business hours?
May this subject export without approval?
May this subject export data with this classification?
May this subject access the generated file later?

@GetMapping("/cases/export.csv")
public void export(CaseSearchQuery query, HttpServletResponse response) {
    List<CaseRecord> records = caseRepository.search(query);
    csvWriter.write(records, response.getOutputStream());
}

public record ExportJob(
        ExportJobId id,
        TenantId tenantId,
        UserId requestedBy,
        String exportType,
        String filterJson,
        String fieldSet,
        String purpose,
        String policyVersion,
        Instant requestedAt,
        Instant expiresAt,
        ExportStatus status,
        String resultObjectKey,
        String resultSha256,
        long rowCount
) {}

Only the requesting user, approved delegates, or export administrators may download an export.
Export file access expires.
Export file access is audited.
Export contents are shaped by the subject's export field policy at creation time.

public enum CaseExportField {
    CASE_ID,
    TITLE,
    STATUS,
    ASSIGNEE,
    CREATED_AT,
    RISK_SCORE,
    CLASSIFICATION,
    WHISTLEBLOWER_IDENTITY,
    INTERNAL_NOTES,
    LEGAL_HOLD
}

public boolean canExportField(Subject subject, CaseExportField field, ExportPurpose purpose) {
    return switch (field) {
        case CASE_ID, TITLE, STATUS, ASSIGNEE, CREATED_AT -> subject.hasPermission("case.export.basic");
        case RISK_SCORE, CLASSIFICATION -> subject.hasPermission("case.export.sensitive");
        case WHISTLEBLOWER_IDENTITY -> subject.hasPermission("case.export.protected_identity")
                && purpose == ExportPurpose.REGULATORY_SUBMISSION;
        case INTERNAL_NOTES, LEGAL_HOLD -> subject.hasPermission("case.export.legal");
    };
}

case.export.basic: max 1,000 rows
case.export.sensitive: max 10,000 rows with approval
case.export.regulatory_submission: max 100,000 rows with case-specific purpose
case.export.full_tenant: break-glass only

public record ExportLimits(
        long maxRows,
        boolean requiresApproval,
        boolean requiresPurpose,
        Duration fileTtl
) {}

{
  "region": "WEST",
  "openHighRiskCases": 3,
  "overdueCases": 1
}

public record ReportDefinition(
        String reportKey,
        Set<String> requiredPermissions,
        Set<String> allowedParameters,
        Set<String> sensitiveMetrics,
        boolean supportsDrillDown,
        boolean supportsExport
) {}

AuthorizationDecision decision = authorizationService.decide(
        AuthorizationRequest.builder()
                .subject(subject)
                .action("report.run")
                .resource(ResourceRef.of("report", reportKey))
                .attribute("report.parameters", request.parameters())
                .build()
);

select region, count(*)
from cases
where status = 'OPEN'
group by region;

select c.region, count(*)
from cases c
where c.status = 'OPEN'
  and c.tenant_id = :tenant_id
  and exists (
      select 1
      from visible_case_scope v
      where v.case_id = c.id
        and v.subject_id = :subject_id
  )
group by c.region;

public ReportCell renderCount(long count, ReportSensitivity sensitivity) {
    if (sensitivity == ReportSensitivity.PROTECTED && count > 0 && count < 5) {
        return ReportCell.suppressed("LOW_CELL_COUNT");
    }
    return ReportCell.number(count);
}

report.run != case.search
report.view_aggregate != report.drill_down
report.export != report.run

POST /jobs/bulk-close-cases

Authorize at submission.
Store authorization snapshot.
Recheck at execution.
Require resource version match for sensitive operations.

public record AuthorizedJob(
        JobId id,
        TenantId tenantId,
        UserId requestedBy,
        String action,
        String requestPayloadHash,
        String policyVersionAtSubmission,
        Map<String, Long> resourceVersions,
        Instant submittedAt,
        Instant expiresAt,
        JobStatus status
) {}

public void execute(JobId jobId) {
    AuthorizedJob job = jobRepository.find(jobId);

    Subject subject = subjectRepository.snapshotSubject(job.requestedBy(), job.tenantId());

    if (job.expiresAt().isBefore(clock.instant())) {
        jobRepository.markRejected(jobId, "JOB_AUTHORIZATION_EXPIRED");
        return;
    }

    BulkCloseCommand command = payloadStore.read(jobId, BulkCloseCommand.class);

    BulkAuthorizationPlan plan = bulkAuthorizationPlanner.planCloseCases(subject, command);

    if (!plan.allAllowed()) {
        jobRepository.markRejected(jobId, "AUTHORIZATION_RECHECK_FAILED");
        audit.jobRejected(job, plan);
        return;
    }

    bulkCloseExecutor.execute(command, subject, plan);
}

public final class BulkAuthorizationPlanner {
    private final AuthorizationService authorizationService;
    private final CaseRepository caseRepository;

    public BulkAuthorizationPlan planAssignCases(Subject subject, BulkAssignCommand command) {
        List<CaseRecord> cases = caseRepository.findByIdsInTenant(
                subject.tenantId(),
                command.caseIds()
        );

        Map<CaseId, CaseRecord> byId = cases.stream()
                .collect(Collectors.toMap(CaseRecord::id, Function.identity()));

        List<BulkAuthorizationItem> items = new ArrayList<>();

        for (CaseId id : command.caseIds()) {
            CaseRecord record = byId.get(id);
            if (record == null) {
                items.add(BulkAuthorizationItem.notFoundOrDenied(id));
                continue;
            }

            AuthorizationDecision decision = authorizationService.decide(
                    AuthorizationRequest.builder()
                            .subject(subject)
                            .action("case.assign")
                            .resource(ResourceRef.of("case", id.value()))
                            .attribute("targetAssigneeId", command.assigneeId().value())
                            .attribute("case.status", record.status().name())
                            .attribute("case.classification", record.classification().name())
                            .attribute("case.version", record.version())
                            .build()
            );

            items.add(BulkAuthorizationItem.from(id, decision, record.version()));
        }

        return new BulkAuthorizationPlan("case.assign", subject.id(), items);
    }
}

public record BulkAuthorizationPlan(
        String action,
        UserId subjectId,
        List<BulkAuthorizationItem> items
) {
    public boolean allAllowed() {
        return items.stream().allMatch(BulkAuthorizationItem::allowed);
    }

    public List<CaseId> allowedIds() {
        return items.stream()
                .filter(BulkAuthorizationItem::allowed)
                .map(BulkAuthorizationItem::resourceId)
                .toList();
    }
}

Assign cases A, B, C to user X.

May caller assign each case?
May caller assign to target user X?
May target user X receive each case?

AuthorizationDecision targetDecision = authorizationService.decide(
        AuthorizationRequest.builder()
                .subject(subject)
                .action("case.assign_to_user")
                .resource(ResourceRef.of("user", command.assigneeId().value()))
                .attribute("targetUser.status", targetUser.status().name())
                .attribute("targetUser.unitId", targetUser.unitId().value())
                .build()
);

AuthorizationDecision itemDecision = authorizationService.decide(
        AuthorizationRequest.builder()
                .subject(subject)
                .action("case.assign")
                .resource(ResourceRef.of("case", caseRecord.id().value()))
                .attribute("targetUserId", targetUser.id().value())
                .attribute("targetUserClearance", targetUser.clearance().name())
                .attribute("caseClassification", caseRecord.classification().name())
                .build()
);

Caller can modify the case, therefore caller can assign it to anyone.

If the original operation completed, return the original result for the same subject, same tenant, same payload hash, and same idempotency key.
If payload differs, reject.
If subject differs, reject.
If operation was only reserved but not executed, re-evaluate authorization.

public record IdempotencyRecord(
        String key,
        TenantId tenantId,
        UserId subjectId,
        String action,
        String payloadHash,
        String resultHash,
        Instant createdAt,
        Instant expiresAt
) {}

public enum BulkItemStatus {
    CHANGED,
    UNCHANGED,
    DENIED,
    NOT_FOUND,
    NOT_FOUND_OR_DENIED,
    CONFLICT,
    VALIDATION_FAILED,
    SKIPPED,
    FAILED
}

Use NOT_FOUND_OR_DENIED when existence must be hidden.
Use DENIED only when caller may know the object exists.
Use CONFLICT for version/state mismatch.
Use VALIDATION_FAILED for request errors unrelated to authorization.
Use FAILED for internal execution failure after authorization.

{ "reason": "subject.clearance=LOW < object.classification=SECRET" }

{ "reasonCode": "INSUFFICIENT_CLEARANCE" }

subject id
subject version / role version / entitlement version
subject tenant
resource type
resource id
resource version or authorization-relevant version
action
policy version
context digest

userId + permissionName

public record DecisionCacheKey(
        TenantId tenantId,
        UserId subjectId,
        long subjectAuthzVersion,
        String action,
        String resourceType,
        String resourceId,
        long resourceAuthzVersion,
        String policyVersion,
        String contextDigest
) {}

cache attributes and scopes, not final high-risk mutation decisions.

{
  "eventType": "BULK_AUTHORIZATION_DECISION",
  "tenantId": "T1",
  "subjectId": "U1",
  "action": "case.assign",
  "operationId": "op-123",
  "policyVersion": "2026-07-03.4",
  "mode": "PARTIAL_SUCCESS",
  "items": [
    { "resourceType": "case", "resourceId": "CASE-100", "decision": "ALLOW" },
    { "resourceType": "case", "resourceId": "CASE-101", "decision": "DENY", "reasonCode": "CASE_OUTSIDE_JURISDICTION" }
  ]
}

{
  "eventType": "EXPORT_AUTHORIZATION_DECISION",
  "tenantId": "T1",
  "subjectId": "U1",
  "action": "case.export",
  "exportJobId": "export-123",
  "policyVersion": "2026-07-03.4",
  "queryHash": "sha256:...",
  "fieldSet": "REGULATORY_BASIC",
  "rowCount": 10432,
  "resultSha256": "sha256:...",
  "storageObjectKey": "exports/T1/export-123.enc",
  "decision": "ALLOW"
}

Who requested the operation?
What operation was requested?
Which resource set was affected?
Which policy version made the decision?
Which fields were exposed?
How many rows were exported?
Was the operation approved?
Who downloaded the result?
When did the file expire?

update cases
set status = 'CLOSED', closed_by = :subject_id, closed_at = now()
where id = :case_id
  and tenant_id = :tenant_id
  and status = 'OPEN'
  and legal_hold = false
  and version = :expected_version;

int updated = caseRepository.closeIfStillAllowedFacts(
        caseId,
        subject.tenantId(),
        expectedVersion,
        subject.id()
);

if (updated == 0) {
    throw new ConflictException("Case changed before close");
}

Prefer soft delete with retention.
Require explicit delete permission.
Require object-level delete decision per item.
Require legal hold check.
Require tenant check.
Require reason.
Require audit before mutation.
Consider maker-checker for high-risk deletes.
Never allow bulk delete based only on search filters without preview.

DELETE /cases?status=CLOSED

POST /cases/delete-preview
POST /cases/delete-approval
POST /cases/delete-apply

{
  "filter": {
    "status": "OPEN",
    "region": "WEST",
    "ageDaysGreaterThan": 90
  },
  "operation": "ESCALATE"
}

1. Validate filter fields.
2. Build authorization scope.
3. Materialize candidate IDs into a job table.
4. Store query hash, policy version, and resource versions.
5. Show preview count and sample.
6. Require confirmation/approval.
7. Apply to materialized IDs, with recheck/version check.

public record BulkJobItem(
        JobId jobId,
        String resourceType,
        String resourceId,
        long resourceVersionAtPreview,
        BulkItemStatus previewStatus,
        String previewReasonCode
) {}

Bulk close case
- case service changes case state
- task service closes open tasks
- document service locks attachments
- notification service sends messages
- reporting service updates projections

User-facing service authorizes user command.
Operation ID is created.
Downstream commands include operation ID, tenant ID, subject ID, and authorized action.
Downstream services verify operation record or enforce their own resource-specific guards.

{
  "eventType": "CaseBulkClosed",
  "operationId": "op-123",
  "tenantId": "T1",
  "authorizedBy": "U1",
  "policyVersion": "2026-07-03.4",
  "caseIds": ["CASE-100", "CASE-102"],
  "occurredAt": "2026-07-03T10:15:00Z"
}

public record BatchGetRequest<T>(
        List<T> ids,
        Set<String> include
) {}

public record BatchGetResponse<T, V>(
        List<BatchItem<T, V>> items
) {}

public record BatchItem<T, V>(
        T id,
        BulkItemStatus status,
        String reasonCode,
        V value
) {}

public record BulkMutationResponse<T>(
        String operationId,
        String mode,
        int requested,
        int changed,
        int failed,
        List<BulkMutationItem<T>> items
) {}

public record BulkMutationItem<T>(
        T id,
        BulkItemStatus status,
        String reasonCode,
        Long previousVersion,
        Long newVersion
) {}

public record ExportRequest(
        String reportType,
        Map<String, Object> filter,
        Set<String> fields,
        String purpose,
        String idempotencyKey
) {}

public record ExportAcceptedResponse(
        String exportJobId,
        String status,
        Instant expiresAt
) {}

Given user can read CASE-1 but not CASE-2
When user batch reads [CASE-1, CASE-2]
Then response includes CASE-1
And response does not expose CASE-2 fields
And response does not leak CASE-2 existence unless policy allows it

Given user can see only unit A
When user searches all OPEN cases
Then SQL scope includes unit A constraint
And total count equals visible count
And pagination is applied after authorization scope

Given user cannot see riskScore
When user sorts by riskScore
Then request is denied

Given one allowed case and one denied case
When bulk assign runs in all-or-nothing mode
Then no case changes

Given one allowed case and one denied case
When bulk assign runs in partial mode
Then only allowed case changes
And denied case is audited

Given user cannot export legal fields
When user exports case data
Then CSV does not contain legal fields
And audit records field set

Given user schedules bulk close
And case enters legal hold before job execution
When job runs
Then case is not closed
And job records authorization recheck failure

@PreAuthorize("hasRole('SUPERVISOR')")
@PostMapping("/cases/bulk-close")
public BulkCloseResult close(@RequestBody BulkCloseRequest request) {
    return service.close(request.caseIds());
}

Page<Case> page = repository.search(filter, pageable);
return page.items().stream().filter(this::canRead).toList();

csvWriter.write(caseRepository.search(filter));

worker.closeCases(message.caseIds());

cacheKey = reportKey + filterHash

{ "denied": ["CASE-123"] }

POST /cases/bulk-delete?status=CLOSED

What is the operation-level permission?
What is the object-level permission?
Is the target set explicit IDs, query filter, or derived report dataset?
Is authorization applied before pagination and count?
Are filter fields authorized?
Are sort fields authorized?
Are response fields authorized?
Are export fields authorized separately from UI fields?
Are row limits policy-driven?
Is partial success allowed?
Are denied and missing collapsed where necessary?
Is every mutation protected against race conditions?
Does async execution recheck authorization?
Is the job/download/report itself a protected resource?
Does audit capture policy version and resource set digest?
Is cache keyed by authorization-relevant facts?
Are negative tests written for mixed allowed/denied objects?

case
evidence
task
notice
inspection
legal_review
export_job
report

case officer
supervisor
legal reviewer
auditor
regional director
external agency liaison
system worker

Escalate all overdue high-risk cases in region WEST.

Caller must have case.bulk_escalate.
Caller must be allowed to see region WEST cases.
Caller must be allowed to escalate each case.
Cases under legal hold are denied.
Cases assigned to another restricted unit are denied.
Sealed evidence is not exported in preview.
Preview materializes candidate case IDs.
Apply rechecks status/version/legal hold.
Partial success is allowed only if policy says so.
Audit records allowed/denied counts and reason codes.

User is supervisor -> allow bulk endpoint.

User may use this operation.
User may access this dataset.
User may perform this action on each object.
User may see or change each field.
User may persist, export, schedule, or replay the result.

constrain the query so unauthorized resources cannot appear

evaluate every resource decision explicitly